6,685 件 ・ 関連度順
概要と使いどころ
Exploit local systems via DLL load order hijacking. This skill details how to identify applications on Windows that insecurely load Dynamic Link Libraries (DLLs) and how to substitute a legitimate DLL with a malicious one to achieve privilege escalation or persistent access.
日本語の概要は準備中です。原文の説明を表示しています。
Master Burp Suite Professional for comprehensive web application security testing. Use this skill when performing manual web application assessments with Burp Suite including proxy interception, Scanner automation, Intruder attacks, Repeater analysis, and extension integration. Covers advanced techniques like match-and-replace rules, macro authentication, Collaborator for OOB testing, and Turbo Intruder for high-speed fuzzing.
日本語の概要は準備中です。原文の説明を表示しています。
Penetration test AWS cloud environments for misconfigurations, privilege escalation, data exposure, and lateral movement. Use this skill when assessing AWS accounts for security weaknesses including S3 bucket misconfigurations, IAM policy flaws, EC2 metadata exploitation, Lambda function abuse, and cross-account attack paths. Covers both external and authenticated AWS pentesting.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit Server-Side Request Forgery (SSRF) vulnerabilities on Amazon Web Services (AWS) EC2 instances to access the highly sensitive Instance Metadata Service (IMDS). Circumvent basic protections and extract temporary IAM access keys, escalating privileges comprehensively across the AWS Cloud environment.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit misconfigurations in AWS Cognito, specifically focusing on unauthorized identity pool access, user pool self-registration issues, and privilege escalation via custom attributes to access broader AWS infrastructure.
日本語の概要は準備中です。原文の説明を表示しています。
Bypass the Windows Antimalware Scan Interface (AMSI) using memory patching, reflection, and obfuscation techniques. Execute undetected PowerShell, VBScript, JScript, and .NET assemblies in-memory without triggering Microsoft Defender or third-party AV/EDR solutions. Use this skill during Red Team engagements when loading offensive tools (Mimikatz, Rubeus, SharpHound) in memory on defended Windows endpoints.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit Active Directory Certificate Services (AD CS) misconfigurations, specifically ESC1. By requesting a certificate based on a overly permissive template that allows the enrollee to supply a Subject Alternative Name (SAN), an attacker can impersonate highly privileged users (like Domain Admins) and seamlessly escalate privileges across the entire AD environment.
日本語の概要は準備中です。原文の説明を表示しています。
Execute a Kerberoasting attack to extract and systematically crack the NTLM hashes of Service Principal Name (SPN) accounts in an Active Directory environment. Uses tools like Rubeus, Impacket (GetUserSPNs), and Hashcat to achieve domain privilege escalation domain: cybersecurity
日本語の概要は準備中です。原文の説明を表示しています。
Deep API security assessment beyond surface scanning. Covers the full OWASP API Security Top 10 (2023): Broken Object Level Authorization (BOLA / IDOR), Broken Authentication, Broken Object Property Level Authorization (mass assignment + excessive data exposure), Unrestricted Resource Consumption, Broken Function Level Authorization (BFLA / vertical privilege escalation), Unrestricted Access to Sensitive Business Flows, Server-Side Request Forgery via API parameters, Security Misconfiguration, Improper Inventory Management (shadow/zombie/deprecated endpoints, v1/v2 drift), and Unsafe Consumption of third-party APIs. Works across REST, GraphQL, gRPC, SOAP, and MCP servers. Discovers APIs from OpenAPI/Swagger specs, GraphQL introspection, gRPC reflection, .well-known endpoints, JS bundles, and traffic capture. Uses kiterunner, ffuf, schemathesis, restler-fuzzer, openapi-fuzzer, graphql-cop, clairvoyance, batchql, inql, jwt_tool, postman, mitmproxy, and manual http(action="request", ...) payloads. Every technique includes actual payloads, commands, and verification logic. Chains from /pentester or /codebase when API endpoints are discovered, chains into /web-exploit when classic injection points are found in API parameters, chains into /post-exploit when RCE is achieved, and chains into /ai-redteam when an LLM/AI endpoint is discovered (chat APIs, completion endpoints, RAG search, agentic tool-use, MCP servers).
日本語の概要は準備中です。原文の説明を表示しています。
Product marketing and go-to-market strategy for B2B SaaS launches and positioning. Use this skill when planning a product launch, developing positioning and messaging, analyzing competitive landscape, building customer advocacy programs, designing a customer referral program (who may accept the reward, how the introduction is made), designing a win/loss interview program, working out why we lose deals, designing GTM strategy, creating category positioning, planning analyst briefings, or deciding which country to expand into and how far to localize. Also use it for an early-stage startup where the founder is still doing the selling — running founder-led sales, setting up a design-partner program, judging whether you have product-market fit, deciding what not to do yet, deciding when to hire the first AE or first marketer, and moving upmarket to larger buyers. Also use it when your company has just acquired another (or is about to), to plan the marketing integration: what you may and may not do between signing and close, the first letter to the acquired customers, whether to keep, endorse, fold in or retire the acquired brand, merging the two marketing databases without mailing people who opted out, when to start cross-selling, and announcing a product sunset. Also use it to design a demand-generation campaign and the channel plan it runs on: one campaign with one job, the offer for buyers who are and are not in market, what each channel is for, the kill and scale rules set before launch, the follow-up sales agrees to, the yearly calendar of always-on programs and tentpole campaigns, and which channels to keep, test or stop. Also use it for brand marketing and demand creation — how much to spend on brand versus performance, what to measure when a brand campaign produces no conversion event, and how to answer "we cannot attribute it". Also triggers on: founder-led sales, founder-led GTM, design partners, design partner agreement, first customers, first 10 customers, do we have product-market fit, PMF, Sean Ellis test, very disappointed survey, pre-seed, seed stage, when to hire our first AE, first sales hire, first marketing hire, moving upmarket, going upmarket, enterprise readiness, first enterprise deal, what do enterprise buyers need before they sign, positioning, product launch, beta program, early access program, design partners, private preview, public preview, general availability, GA launch, when can we call it GA, can sales sell a beta feature, selling the roadmap, launch tier, competitive intelligence, messaging, customer advocacy, win/loss analysis, win/loss interviews, why we lose deals, closed-lost analysis, loss reason, close-reason field, competitive displacement, displace an incumbent, rip and replace, competitive takeout, switch from a competitor, win deals from a competitor, incumbent contract, renewal window, auto-renewal notice period, switching costs, EU Data Act, cloud switching rights, why do we lose to no decision, GTM, category design, ideal customer profile, ICP, what is our real ICP, who actually buys from us, refresh our ICP from closed-won deals, ICP refresh before planning, analyst briefing, G2 review, international expansion, market entry, expand into Europe, which country should we launch in next, localization, translate our site, in-country go-to-market, regional GTM, is cold email legal in Germany, brand marketing, brand awareness, brand vs performance, brand versus demand gen, demand creation, demand capture, 95-5 rule, out of market buyers, category entry points, distinctive brand assets, mental availability, brand tracking, brand health, brand lift, share of search, how do we measure brand, justify brand spend, brand budget. Also triggers on public-sector marketing: sell to government, government marketing, public sector go-to-market, federal marketing, state and local government, SLED, FedRAMP, FedRAMP marketing claims, can we say FedRAMP ready, GovRAMP, StateRAMP, VPAT, accessibility confor
日本語の概要は準備中です。原文の説明を表示しています。
Resolves dynamically hashed Windows API names by brute-forcing observed hash constants against a wordlist of API/DLL names using common malware hashing algorithms (ROR13, djb2, FNV, CRC32). Activates for requests to resolve API hashes, identify hashed imports, or reverse an API hashing routine.
日本語の概要は準備中です。原文の説明を表示しています。
Analyzes legacy Excel 4.0 (XLM) macro malware by parsing extracted macro-sheet formulas for auto-executing names, obfuscation (FORMULA.FILL, CHAR concatenation), and download or execution primitives (EXEC, CALL, REGISTER). Activates for requests to analyze XLM macros, examine Excel 4.0 macro sheets, or deobfuscate legacy spreadsheet macros.
日本語の概要は準備中です。原文の説明を表示しています。
Analyzes malicious VBScript, WSF, and HTA scripts: parsing WSF/HTA containers, decoding VBScript.Encode (#@~^) and string obfuscation, and identifying WScript.Shell/ActiveX abuse to recover dropper behavior. Activates for requests to analyze VBScript, decode a WSF/HTA, or investigate a Windows Script Host dropper.
日本語の概要は準備中です。原文の説明を表示しています。
Analyzes suspected webshells (PHP, ASPX/ASP, JSP) by detecting dynamic-execution sinks, input-to-sink data flow, and common encoder/obfuscation chains, then decoding obvious layers to reveal the command interface. Activates for requests to analyze a webshell, identify a PHP/ASPX/JSP backdoor, or deobfuscate server-side malicious scripts.
日本語の概要は準備中です。原文の説明を表示しています。
Create a complete feature module with folder structure, Assembly Definition (.asmdef), test assembly, and namespace. Use when adding a new feature, system, or module to a Unity project. Triggers on requests like "create a new feature", "scaffold a module", "add a combat system", "I need a health system", "set up inventory", "create a new module for X", "add a new system", "new feature folder", or any task requiring new folders, assemblies, or namespaces for a gameplay feature — even when the user just names a system they want to build from scratch. Reads ProjectConfig.yaml for folder_strategy and MCP availability.
日本語の概要は準備中です。原文の説明を表示しています。
Unity game loop and progression design-to-code translation. Core loop scaffolding, session lifecycle, win/lose condition architecture, meta loop hooks, tunable difficulty, pacing & encounter timing. DESIGN INTENT format: INTENT/WRONG/RIGHT/SCAFFOLD/DESIGN HOOK. Based on Unity 6.3 LTS.
日本語の概要は準備中です。原文の説明を表示しています。
Orchestrates comprehensive production readiness reviews and assessments for GKE clusters and workloads across scalability, security, reliability, observability, backup/DR, and cost optimization. Use when asked to productionize, prepare, assess, audit, or review a GKE cluster or workload before going live to production. Don't use for deep-dive single-domain implementation (use specific domain skills like gke-workload-scaling, gke-platform-security, gke-workload-security, gke-service-networking, gke-reliability instead).
日本語の概要は準備中です。原文の説明を表示しています。
Provides GKE golden path configuration defaults, production readiness checklists, and cluster default patterns. Use when designing GKE clusters, verifying GKE production readiness, or checking configurations against GKE defaults. Don't use for setting up workload autoscaling specifically (use gke-workload-scaling instead).
日本語の概要は準備中です。原文の説明を表示しています。
Build QA quality dashboards, calculate defect metrics, analyze escape rates, and produce quality trend reports. Use this skill whenever a QA lead or manager needs to measure and communicate quality outcomes. Trigger on phrases like "quality metrics", "defect density", "escape rate", "bug trends", "quality dashboard", "sprint quality report", "test coverage metrics", "QA KPIs", "how is quality trending", "defect leakage", "production bugs this quarter", "mean time to detect", "quality scorecard", or any request to quantify, visualize, or report on the quality of a product or testing process. Also trigger when a manager asks "how is QA performing?" or an engineering lead asks "what does our defect data tell us?".
日本語の概要は準備中です。原文の説明を表示しています。
Use when a task needs the judgment of a licensed elevator mechanic — diagnosing a governor or safety-circuit fault, planning or witnessing a Category 1/Category 5 periodic test, sequencing an elevator or escalator installation/modernization to code, or deciding whether equipment can stay in service pending a repair.
日本語の概要は準備中です。原文の説明を表示しています。
Use when a task needs the judgment of a dental hygienist — full-mouth periodontal charting and staging, sequencing scaling and root planing across quadrants, deciding whether a finding needs escalation back to the dentist, or building a home-care compliance plan for a patient with active periodontal disease.
日本語の概要は準備中です。原文の説明を表示しています。
Use when a task needs the judgment of a Customer Service Representative — de-escalating an angry customer, deciding whether a policy exception is worth the cost, deciding when to escalate versus resolve on the spot, drafting a resolution response, or diagnosing why first-call-resolution is low for an issue type.
日本語の概要は準備中です。原文の説明を表示しています。
Use when a task needs the judgment of a Biofuels/Biodiesel Technology and Product Development Manager — deciding whether a lab/bench-scale process is ready to scale up, evaluating feedstock flexibility tradeoffs in process design, pricing a technology's value against regulatory credit pathways (RFS RIN, LCFS CI score), or managing IP strategy for a novel conversion process. Distinct from biofuels-production-manager, which runs an existing operating facility — this role owns R&D and commercialization of new or improved process technology.
日本語の概要は準備中です。原文の説明を表示しています。
Use when a task needs the judgment of a professional Actor — breaking down sides for a self-tape audition, preparing a character choice for rehearsal, deciding between two conflicting bookings, reading a contract offer for scale vs. scale-plus terms, or diagnosing why callbacks aren't converting to bookings.
日本語の概要は準備中です。原文の説明を表示しています。